CVE-2026-80674

The legacy in-kernel NTFS driver (fs/ntfs) in the Linux kernel only sanity-checks a base inode's $ATTRIBUTE_LIST on the non-resident path, so a resident attribute list is copied into ni->attr_list with a plain memcpy() and no validation at all. When the kernel parses a crafted NTFS filesystem image whose base inode carries a malformed resident attribute list, later walks of that list (ntfs_external_attr_find(), ntfs_inode_attach_all_extents(), ntfs_attrlist_need()) trust the unchecked entries and can perform out-of-bounds reads of the attribute-list buffer. An attacker who can get a system to mount or read such an image (e.g., a USB drive or attached disk image) can cause kernel out-of-bounds reads, leading to kernel crashes (denial of service) and potentially disclosure of kernel memory; the flaw is rated 9.8 critical on the supplied CVSS vector. Any Linux system using the in-kernel NTFS driver to process untrusted NTFS volumes is affected, with practical exposure limited to hosts that mount attacker-supplied NTFS filesystems. There is currently no known in-the-wild exploitation, no public proof-of-concept, and a low 0.4% EPSS probability of exploitation in the next 30 days.

What to do: Apply the kernel fix once your distribution ships it (the fix adds ntfs_attr_list_is_valid() validation on the resident path and at the other attribute-list walks; no specific fixed version numbers are provided in the data). Until then, avoid mounting untrusted NTFS volumes, removable media, or disk images on vulnerable hosts, or handle NTFS with ntfs3/ntfs-3g instead of the legacy in-kernel driver. Check exposure by verifying whether the legacy NTFS driver is present and loaded (e.g., 'lsmod | grep ntfs' and checking CONFIG_NTFS_FS in the kernel config).